Setting up Instagram Login: Instagram app ID and secret

Instagram Login or Facebook Login: which one?

Instagram Login vs Facebook Login

How to set up Instagram Login in the Meta dashboard

1. 1

   Open a Meta app with the Instagram use case

   On developers.facebook.com/apps create an app and choose the Instagram use case (“Manage messaging & content on Instagram”), or add it to a compatible existing app. Then open Instagram → API setup with Instagram login in the left menu. Button labels may change — the goal is to reach that section.

2. 2

   Copy the Instagram app ID and secret

   They're under “Set up Instagram business login” → Business login settings. These are NOT the Meta App ID and App Secret from App settings → Basic: per Meta's docs, apps using Business Login for Instagram use the Instagram app ID shown in this section.

3. 3

   Add the OAuth redirect URI

   In Business login settings add your callback address to OAuth redirect URIs. It must exactly match the redirect_uri in the authorization request.

4. 4

   Check the permissions

   Make sure the use case includes the instagram_business_* permissions you need (table below). The old names (business_basic and so on) were deprecated on January 27, 2025 — your code must use the new ones.

5. 5

   Test with your own account

   The same page lets you add an Instagram account to generate a test token. With Standard Access the app works only for accounts you own or manage, or that you added to the app in the App Dashboard.

6. 6

   Configure webhooks

   In the webhooks section enter the Callback URL and Verify token, verify, then subscribe to comments (mentions arrive inside this event) and messages. Meta requires the app to be Live, Advanced Access for comments, a public account, and a POST /me/subscribed_apps call on graph.instagram.com for each account.

7. 7

   App Review and Business Verification

   To connect accounts you don't own or manage, get Advanced Access through App Review; Advanced Access requires Business Verification.

Which permissions (scopes) do you need?

This is the default list for Socialift's “Instagram Login app” card and for the Instagram(...) client.

Refresh conditions (Meta): the token is at least 24 hours old, still valid, and the user granted instagram_business_basic. A token not refreshed within 60 days expires.

How to add the Instagram Login app to Socialift

1. 1

   “Kalitlar” (Keys) → “Instagram Login app”

   In the dashboard open “Kalitlar” and the “Instagram Login app” card. Paste the Redirect URI from the “Konsolga ko'chiring” (Copy to console) block into Business login settings → OAuth redirect URIs.

2. 2

   Enter and verify the keys

   Fill in “Instagram app ID” and “Instagram app secret”; “Scope'lar” (Scopes) is optional (empty = default list). Click “Saqlash va tekshirish” (Save and verify): Socialift asks Meta for an app access token with this pair and shows the result on the card.

3. 3

   Copy the webhook URL

   After saving, the card shows Webhook URL, Webhook verify token, Deauthorize callback and Data deletion callback. Paste them into the matching fields in the Meta dashboard. Incoming events are verified with the secret from this card.

4. 4

   Connect the account

   In “Ulanishlar” (Connections) click “Ulash” (Connect) on the “Instagram (Page'siz)” (without Page) card. The account appears as business or creator with its token expiry; “Token'ni yangilash” (Refresh token) extends it.

5. 5

   Subscribe the account to webhooks

   Socialift doesn't subscribe Instagram Login accounts to subscribed_apps automatically. For each account, call POST https://graph.instagram.com/v26.0/me/subscribed_apps?subscribed_fields=comments,messages once with that account's token.

Instagram Login in the Python SDK

Instagram.from_env() reads INSTAGRAM_APP_ID, INSTAGRAM_APP_SECRET and META_GRAPH_VERSION.

import asyncio
import secrets

from socialift import Instagram

REDIRECT_URI = "https://example.com/auth/instagram/callback"  # same as OAuth redirect URIs


async def main() -> None:
    # INSTAGRAM_APP_ID, INSTAGRAM_APP_SECRET (not the Meta App ID!), SOCIALIFT_LICENSE_KEY
    async with Instagram.from_env() as ig:
        state = secrets.token_urlsafe(32)
        print(ig.login_url(redirect_uri=REDIRECT_URI, state=state))

        code = input("code: ")
        bundle = await ig.exchange_code(code, redirect_uri=REDIRECT_URI)  # 60-day token
        profile = await ig.profile(bundle.access_token)
        print(profile.username, bundle.expires_at)


asyncio.run(main())

Common mistakes

• ▸Using the Meta App ID and App Secret for Instagram Login — you need the Instagram app ID and secret.
• ▸The redirect URI differs from the one in OAuth redirect URIs.
• ▸Requesting the old business_* scopes — the new names are instagram_business_*.
• ▸The account isn't professional (personal) — the API can't access it.
• ▸Webhooks are configured, but the account isn't subscribed via /me/subscribed_apps or the app isn't Live.
• ▸The account is private — comment and mention webhooks don't arrive.
• ▸The token wasn't refreshed for 60 days and silently expired.